Shopper: customer detail IDOR exposes administrator and staff records
Shopper (shopper/framework) versions before 2.10.1 are affected, in the setup where staff accounts hold access_dashboard and read_customers permissions. The fix is in 2.10.1.
- Last modified
- Where the record stands: published, rejected by its publisher, or superseded by another id.What do these mean? →
- published
- Whether CISA lists it in its Known Exploited Vulnerabilities catalog: proof that attackers are using it.What do these mean? →
- Not listed in CISA KEV
- How many real-world setups can hit the bug, from the vendor's advisory and CISA data. It does not know your setup.What do these mean? →
- Specific setups only
- Fix
- Fixed in 2.10.1
- Whether working attack code is public (Exploit-DB, Metasploit, Nuclei or GitHub). Public code makes attacks easier.What do these mean? →
- None on Exploit-DB, Metasploit or GitHub
Summary
Shopper, a headless e-commerce admin panel, is affected by an authorization flaw in its customer detail page that lets staff with customer-read permissions view administrator and staff account profiles they should not access. An attacker with such a staff login could also enumerate user IDs and, if they hold customer-delete permission, perform destructive actions against non-customer accounts.
Summarized by anthropic/claude-haiku-5.5. Verify details against the original sources.
Read the original description
Shopper is a Headless e-commerce Admin Panel. Prior to 2.10.1, the customer detail route `/cpanel/customers/{user}/show` in `packages/admin/src/Livewire/Pages/Customers/Show.php` checks `read_customers` but looks up an arbitrary user ID without applying the `customers` role scope used by the listing. Authenticated staff holding `access_dashboard` and `read_customers` can change the user ID to retrieve administrator or staff profiles despite lacking `view_users`, which protects the separate team-management interface. The flaw exposes account profile data and permits user-ID enumeration through differing success, denial, and not-found responses. If the same role also holds `delete_customers`, `anonymizeAction()` operates on the unrestricted loaded user model and can enable destructive follow-up against non-customer accounts. This issue is fixed in version 2.10.1.
Timeline
- CVE published
- First seen by cve.now
Affected versions
- shopperlabs shopper
fixed in 2.10.1
References 4
GitHub · shopperlabs/shopper
Questions about CVE-2026-62991
What does this mean?
An authenticated staff user can view administrator and staff account profile data by changing the user ID in the customer detail URL. This bypasses the view_users access boundary and makes it possible to enumerate user IDs.Source: github.com
Am I affected, and how do I check?
Shopper (shopper/framework) versions before 2.10.1 are affected. The reported setup involves a staff account holding only access_dashboard and read_customers permissions. Compare the installed shopper/framework version with 2.10.1 and review which staff roles hold those two permissions.Source: github.com
What should I do about it?
Upgrade shopper/framework to 2.10.1 or later, which contains the fix.Source: github.com
Is it being exploited?
It is not in CISA's Known Exploited Vulnerabilities catalog, and CISA's SSVC assessment does not mark exploitation as active. That does not mean it has not been attacked: vendors and researchers can report attacks before CISA lists them. No public exploit code is tracked.Source: cve.now feed data